MEDIA YARD LLC · UPDATED SEPTEMBER 25, 2026
Data processing agreement — proposed terms
Organizations should contact hello@yarnfire.com before sending personal data for processing on their behalf. The parties, processing schedule, security evidence, subprocessors, locations and transfer mechanism must be completed and accepted in an applicable service agreement. This page alone does not establish GDPR compliance or activate a school/enterprise plan.
1. Parties and scope
The customer organization is the controller and Media Yard LLC is the processor only for customer personal data processed on documented instructions under an executed agreement. Yarnfire’s independent account administration, legal compliance and security purposes must be identified separately. This proposal covers hosting and delivery of authorized group content, crew membership, shared memories and permitted exports.
2. Processing schedule
The final schedule must identify the customer and contacts; service and term; categories of participants; names/nicknames, membership roles, activity responses and chosen memories actually submitted; operations performed; retention/deletion periods; hosting locations; and authorized access. Special-category data, student records and systematic employee assessment are outside the proposed scope unless separately assessed and expressly agreed.
3. Instructions and confidentiality
Process personal data only on documented lawful instructions, including transfers, unless law requires otherwise; inform the controller of such legal requirements where permitted. Notify the controller if an instruction appears to infringe applicable data protection law. Personnel with access must be bound by confidentiality and access limited to their duties.
4. Security
Maintain risk-appropriate technical and organizational measures. The executed security schedule must describe access control, secure transport, credential handling, vulnerability management, incident response, backup/recovery, deletion and access reviews. Current application controls include HTTPS delivery, restricted session cookies, crew-level authorization and consent checks; these are not a certification or a complete security audit.
5. Subprocessors
Use subprocessors only with the agreed specific or general written authorization, impose equivalent relevant obligations, remain responsible for their performance, and give advance notice of intended changes with a reasonable opportunity to object. Cloudflare is used for site hosting and database infrastructure. The final register must specify relevant legal entities, functions, locations and safeguards. Stripe’s role for payment processing must be assessed separately when enabled. Creative asset-generation suppliers are not automatically processors of customer crew content.
6. Rights and assistance
Assist the controller, taking account of the processing, with data subject requests, security obligations, breach assessment, impact assessments and regulator consultation. Forward relevant requests to the controller unless legally required to respond directly.
7. Incidents
Notify the controller without undue delay after becoming aware of a personal data breach affecting the customer data. Provide available information about its nature, likely consequences, affected categories, mitigation and contact point, with further updates as information becomes available. The controller remains responsible for its own statutory notification decisions.
8. Return, deletion and audits
At the controller’s choice, return or delete personal data at the end of processing and delete existing copies unless law requires retention. The signed schedule must address backup expiry and exceptions. Make compliance information available and allow reasonable audits or inspections by the controller or its appointed auditor, without defeating mandatory audit rights through fees or restrictions.
9. International transfers
No restricted transfer is authorized merely by this proposal. Before transfer, identify a lawful mechanism, complete required assessments, and attach applicable EU standard contractual clauses and/or a UK transfer instrument when appropriate. Do not claim certification, local residency, or signed clauses without verifying the arrangement.
10. Order of precedence and execution
Mandatory law and applicable transfer clauses take precedence. The executed DPA should control conflicting processing terms in the service agreement. Request the execution package at hello@yarnfire.com.